Data Protection Notice

London Homestays is a service provided by Home from Home Student Services Ltd. We arrange homestays and, where applicable, student residences.

We also operate a related website for language courses, UK Study English (previously London Study English), under the same company. If you use both services, we may share limited contact and booking/enquiry information between them where this is necessary to deal with your enquiry or booking.

This Notice explains how we collect, use, store and share personal data when you: (a) book accommodation through us, (b) apply to host or work with us, or (c) contact us through our website, phone or email.

We do not sell personal data to third parties.

The information we collect depends on your relationship with us. It may include:

• Identity and contact details (name, date of birth, nationality, contact details).
• Booking information (dates, preferences, arrival details, emergency contact details).
• School, agent or guardian details (where applicable).
• Support needs you choose to share with us (for example medical/dietary needs or accessibility requirements).
• Communications with us (emails, messages, notes about issues raised).

• Identity and contact details (name, address, phone/email).
• Host profile information used for placements (for example household details, facilities, house rules, general location/travel information and photos where provided).
• Suitability and safety information from home assessments and reviews.
• Criminal record check status/information where required for placements (see Section 5).
• Bank/payment details for paying hosting fees.
• Communications with us (emails, messages, notes about placements).

• Business contact details (name, role, email/phone, organisation).
• Booking and placement communications.

If you provide personal data about someone else (for example a household member or an emergency contact), you should make sure they know you have shared their details and refer them to this Notice.

UK data protection law requires us to have a lawful basis for using personal data. The most common lawful bases we rely on are:

• Contract – to provide the services you request (for example arranging and managing a booking).
• Legitimate interests – to run our business safely and effectively (for example improving services, preventing fraud, and supporting safeguarding and welfare).
• Legal obligation – to meet legal requirements (for example tax and accounting records).
• Consent – where we ask for it (for example certain marketing communications). You can withdraw consent at any time.
• Vital interests – to protect someone’s life in an emergency.

We typically use personal data for the following purposes:

• To assess applications from hosts and manage host accounts.
• To arrange accommodation and match bookings to suitable accommodation.
• To share the information needed for a host to consider and accept a booking, and to support the booking once confirmed.
• To manage arrivals, departures and ongoing placement support.
• To handle enquiries, complaints and placement issues.
• To make payments, issue invoices and manage accounts.
• To help protect students, hosts and household members (including safeguarding and welfare concerns).
• To meet legal, regulatory, insurance and audit requirements.
• To maintain the security of our systems and prevent misuse or fraud.

Sometimes we may handle information that is more sensitive, such as health information (for example allergies or medical needs) or information linked to safeguarding concerns.

We only use this information when it is necessary, and we take extra care to keep it secure and limit who can access it. The lawful basis will depend on the situation and may include consent or vital interests in an emergency.

Our individual under-18 placements are for ages 16–17 only. We do not place under-16s individually. For under-16 group travel, accommodation may be arranged through a partner organisation with its own safeguarding and data protection arrangements.

For under-18 placements, our policy is that the main host must have an individual DBS check. Other adults normally resident in the home are also subject to criminal record checks.

We do not share DBS certificate numbers or copies of DBS certificates with students, parents/guardians, schools or agents. We use DBS-related information to arrange, verify or record checks and to assess suitability for under-18 placements.

To arrange and manage a placement, we need to share certain information between the booking party and the host household. This is a normal part of providing our service.

We may share host profile information with students, parents/guardians, schools and agents so they can consider and confirm a booking. Host profile information may include photos, household details, facilities, house rules, and general location/travel information. In many cases, host profiles are shared with schools or agents who then share them with the student and/or parent/guardian as part of the booking process.

We share student booking information with the host household so the host can decide whether they can accept the booking and prepare to accommodate the student. This typically includes the student’s name, age, booking dates, arrival details, emergency contact details, and any relevant support needs or preferences that the student/parent/school/agent chooses to share with us. We do not require passport copies or visa documents for accommodation placements.

If you do not want us to share the information needed to arrange a placement, we may not be able to provide the service.

We share personal data only when it is necessary for the purposes set out in this Notice. Depending on the circumstances, this may include:

• Host households (for student bookings).
• Students, parents/guardians, schools or agents (for placement selection and booking management).
• Service providers who support our operations (for example IT, email, document storage and payment providers).
• Professional advisers (for example accountants, insurers, legal advisers) where necessary.
• Relevant authorities or emergency services where there is a serious safety concern or we are required by law (for example police, local authority safeguarding services).
• Partner organisations where we arrange accommodation through them (for example for certain group travel), where applicable.

Where a school, agent or guardian arranges a booking, they may be a separate controller of your personal data. We will share information with them as needed to provide the service and to manage safeguarding and welfare concerns.

Some of our customers and partners are based outside the UK. In practice, this may include sharing host profiles and booking information with schools, agents, students and/or parents/guardians outside the UK as part of the booking process.

Where personal data is transferred outside the UK, we take steps to ensure appropriate safeguards are in place. Depending on the destination and the circumstances, this may include relying on UK adequacy regulations or using approved contractual protections.

We use appropriate technical and organisational measures to help protect personal data, such as access controls and secure systems. No method of transmission or storage is completely risk-free, but we take reasonable steps to reduce risks.

We keep personal data only for as long as we need it for the purposes set out in this Notice, including to meet legal, accounting, insurance and safeguarding requirements.

Because retention needs vary by record type, we review data from time to time and securely delete or anonymise it when it is no longer needed. We may keep some records for longer where it is necessary to deal with complaints, legal claims, or where we are required to keep records by law (for example for tax and accounting).

You have rights under UK data protection law. These include the right to:

• Be informed about how your data is used.
• Access a copy of your personal data.
• Correct inaccurate or incomplete data.
• Request deletion of your data (in certain circumstances).
• Restrict how your data is used (in certain circumstances).
• Object to processing based on legitimate interests (including direct marketing).
• Request data portability (in certain circumstances).
• Withdraw consent where processing is based on consent.

To exercise your rights, contact us using the details in the ‘At a glance’ box. We may need to verify your identity before responding. We will respond within one month. For complex requests, we may extend this by up to two months and we will explain why.

We do not make decisions about you based solely on automated processing where that produces legal (or similarly significant) effects.

We may send service-related communications about your booking or hosting arrangements. Where we send marketing communications, you can opt out at any time using the unsubscribe option provided or by contacting us.

Our website may use cookies and similar technologies to help it function and to understand how people use it. You can manage cookies through your browser settings and, where available, through our cookie settings on the website.

If you have concerns about how we use your personal data, please contact us first so we can try to resolve the issue. You also have the right to complain to the UK regulator, the Information Commissioner’s Office (ICO).

We review this Notice regularly and may update it to reflect changes in law or how we operate. The latest version will be published on our website.

• Safety hub
• Child Protection Policy
• Prevent Policy